Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2006-0818

Опубликовано: 21 июл. 2006
Источник: nvd
CVSS2: 4
EPSS Низкий

Описание

Absolute path directory traversal vulnerability in (1) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (2) VisNetic MailServer before 8.5.0.5 allows remote authenticated users to include arbitrary files via a modified language parameter and a full Windows or UNC pathname in the lang_settings parameter to mail/index.html, which is not properly sanitized by the validatefolder PHP function, possibly due to an incomplete fix for CVE-2005-4558.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:deerfield:visnetic_mail_server:8.3.5:*:*:*:*:*:*:*
cpe:2.3:a:icewarp:web_mail:5.6.0:*:*:*:*:*:*:*
cpe:2.3:a:merak:mail_server:8.3.8r:*:windows:*:*:*:*:*

EPSS

Процентиль: 77%
0.01003
Низкий

4 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

github логотип

GHSA-6fc2-x5pj-mq44

github
почти 4 года назад

Absolute path directory traversal vulnerability in (1) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (2) VisNetic MailServer before 8.5.0.5 allows remote authenticated users to include arbitrary files via a modified language parameter and a full Windows or UNC pathname in the lang_settings parameter to mail/index.html, which is not properly sanitized by the validatefolder PHP function, possibly due to an incomplete fix for CVE-2005-4558.

EPSS

Процентиль: 77%
0.01003
Низкий

4 Medium

CVSS2

Дефекты

NVD-CWE-Other